diff --git a/config/providers_oauth2/argocd.yaml b/config/providers_oauth2/argocd.yaml
index 0033295..fb4d33a 100644
--- a/config/providers_oauth2/argocd.yaml
+++ b/config/providers_oauth2/argocd.yaml
@@ -1,9 +1,18 @@
 # OAuth2/OIDC provider + application for the in-cluster ArgoCD
-# (argocd.k8s.syd1.au.unkin.net). client_secret is read from Vault, not committed.
+# (argocd.k8s.syd1.au.unkin.net), serving the web UI, the `argocd` CLI and the
+# ArgoCD mobile app.
+#
+# public, not confidential: the native clients cannot hold a secret, and they
+# cannot have their own client either -- Authentik derives the `iss` claim from
+# the application slug, while ArgoCD validates every token against the single
+# issuer in oidc.config, so a second application would issue tokens ArgoCD
+# rejects. One client for all three; the strict redirect URIs below are the
+# control. Authentik ignores the secret for public clients, but the Vault read
+# stays so argocd-cm's `$argocd-oidc:client_secret` keeps resolving.
 name: ArgoCD
 authorization_flow: default-provider-authorization-implicit-consent
 invalidation_flow: default-provider-invalidation-flow
-client_type: confidential
+client_type: public
 client_id: argocd
 client_secret_vault:
   mount: kv
@@ -19,3 +28,6 @@ redirect_uris:
   # `argocd login --sso` CLI callback (local listener).
   - matching_mode: strict
     url: http://localhost:8085/auth/callback
+  # Mobile app callback (custom URL scheme, PKCE).
+  - matching_mode: strict
+    url: argocd://auth/callback